Examkin

Question

Difficulty: MediumAWS Config Rules and Conformance Packs

A SysOps Administrator needs to implement automated compliance remediation to stop any Amazon EC2 instance that is found to be non-compliant with the AWS Config managed rule `ec2-instance-no-public-ip`. The administrator wants the compliance check and the remediation to happen automatically with the least operational overhead.

Which approach should the administrator take to meet these requirements?

  1. A
    Configure the AWS Config rule to publish compliance status changes to an Amazon Simple Notification Service (Amazon SNS) topic, and set the Systems Manager Automation document as a direct subscriber to the topic.
  2. B
    Create an Amazon EventBridge rule that filters for AWS Config compliance change events, and configure the target of the EventBridge rule as the AWS Config rule to execute the remediation workflow.
  3. Associate the Systems Manager Automation document `AWS-StopEC2Instance` as a remediation action directly within the AWS Config rule, enable automatic remediation, and select the resource ID parameter mapping.Answer
  4. D
    Associate the Systems Manager Automation document `AWS-StopEC2Instance` as a remediation action in the AWS Config rule, and assign the EC2 instance profile's IAM execution role directly to AWS Config without `iam:PassRole` permissions.

Answer

Associate the Systems Manager Automation document `AWS-StopEC2Instance` as a remediation action directly within the AWS Config rule, enable automatic remediation, and select the resource ID parameter mapping.
The correct option is to associate the Systems Manager Automation document directly within the AWS Config rule, enable automatic remediation, and map the resource ID. This uses the native automated remediation capability of AWS Config, which directly triggers the SSM Automation document whenever a resource is evaluated as non-compliant.

Step-by-Step Solution

1
Identify the native mechanism for automatic compliance remediation in AWS Config.
AWS Config provides built-in integration to trigger AWS Systems Manager Automation documents directly without external routing services.
Using native capabilities minimizes operational overhead and reduces points of failure.
2
Determine the parameter mapping requirements.
The target resource ID (the EC2 instance ID) must be mapped to the Automation document's input parameters.
This ensures that Systems Manager applies the action to the specific non-compliant resource flagged by AWS Config.
3
Verify execution requirements.
An IAM execution role with permissions to stop the EC2 instance must be defined, and the configuring administrator must have permissions to pass this role.
Security controls require explicit role delegation to allow automated tasks to run on AWS resources.

Key Concept

AWS Config native automated remediation leverages Systems Manager Automation documents to automatically correct non-compliant resources using resource ID mappings.
Estimated Time:1m 30s
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic